Security
Your data is your data.
Your credit information is encrypted, never sold, and never shared with lenders unless you share it yourself.Updated October 18, 2026
What we encrypt and how.
AES-256-GCM for your credit reports
The credit reports we obtain for you are encrypted in our application with AES-256-GCM before they are written to the database, on top of our database provider's own encryption at rest. The rest of your account, including your written analyses, is protected by the provider's AES-256 encryption at rest and by access controls.
TLS in transit
All traffic between your browser, our servers, and our credit-data partner travels over TLS (HTTPS only). Your data never moves in the clear.
Privacy-redacted AI prompts
Before any AI model sees your credit data, it passes through an automated redaction step built to remove your name, Social Security number, date of birth, street address, ZIP code, phone number, email address, and full account numbers. The model sees what the analysis needs: your scores, accounts, balances, payment history, inquiries, and public records, plus your city and state.
How your sign-in is protected.
The front door matters as much as the vault.
Two-step sign-in, if you want it
Turn it on in Settings and a sign-in from a browser we do not remember asks for a six-digit code from your authenticator app as well as your password. You can remember a browser for 30 days, add a backup device, and turn it off again. If you lose your device, our support team verifies you and resets it.
Passkeys where your device supports them
Sign in with your face, fingerprint or device PIN instead of a password. A passkey is a key pair: the private half never leaves your device, so there is nothing to phish or reuse. Add, rename and remove passkeys from Settings.
Passwords that are hard to guess
Passwords need at least eight characters with an uppercase letter, a lowercase letter, a number and a symbol, and any password known to have been exposed in a breach elsewhere is refused. Sign-in pauses after repeated failed attempts. Changing your password signs out every other device.
You hear about it
An email goes out when your account is used from a new device, when your password changes, and when two-step sign-in or a passkey is added, removed or reset. Sessions end after 30 days without use and after 90 days in any case, and Sign Out Everywhere ends them all at once.
The list of things you'd be surprised we don't keep.
One exception by design: a credit report you upload yourself is stored as the file you uploaded.
Your Social Security number and full date of birth from identity verification. You enter them on our identity screen, they go to our credit-data partner to verify you, and we keep only your birth year. (The encrypted credit reports we keep may show the last four digits of your SSN, as the bureaus report them.)
Bureau logins. We never ask for your Equifax, Experian, or TransUnion account credentials. Identity is verified with your SSN and date of birth on our own screens plus a secure link sent to your phone
Your identifying details in any AI prompt. An automated redaction step strips your name, SSN, date of birth, street address, phone, email, and full account numbers before any model sees your credit data
Your full card number. It passes through our server once, encrypted in transit, on its way to our payment processor (NMI), which stores it in its secure vault. We keep only the card brand, last four digits, and expiration date
Your credit data and the Fair Credit Reporting Act.
The federal law that governs how consumer credit data can be obtained, used, and disclosed.
Your written instructions, through our credit-data partner
We get your credit data through our credit-data partner, StitchCredit (the CRS Credit API), which holds the relationships with Equifax, Experian, and TransUnion. We request it only under your written instructions, for your own credit monitoring and identity verification.
Written consumer authorization
Before we request anything, you give written authorization on our identity screen. We store the exact wording you agreed to, its version, and the time. You can withdraw it by cancelling your subscription or closing your account; once that takes effect, we request no further credit data.
Disputes go through the bureau
If something on your credit file looks wrong, your credit file record lists each bureau's own dispute page, phone number, and mailing address. You dispute directly with the bureau, at no cost; we don't dispute anything on your behalf.
Soft inquiries only
Every pull we make is a soft inquiry, which does not affect your credit score. Hard inquiries only happen when you formally apply for credit at a lender, outside of our platform.
What we do with your data, and what we don't.
Never sold
We don't sell your data to third parties. Period. No exceptions for marketing partners, advertisers, or data brokers.
Never shared with lenders
We're not a lead-gen company. Lenders don't see your file or your analysis unless you share it with them or apply with them directly.
Who on our team can see it
A small number of our staff (the founder and our operations team) can view member accounts through access-controlled admin tools. We use that access for support, billing, and running the service.
Service providers, named
A short list of providers runs parts of the service for us: hosting, database, payments, email, product analytics, and our AI provider, which only ever receives redacted data. Our privacy policy names each one and what it receives.
Cancelling keeps your history
Cancel anytime from Billing. Monitoring and portal access continue until the end of the period you've paid for, then stop. Your history is kept, and it's all there if you come back.
Closing your account
Email support to close your account. Closing stops monitoring and billing. We don't hard-delete accounts: your records are kept under our retention schedule. Where a privacy law gives you the right to have your data deleted, we honor that request.
Spot something? Tell us.
Found a security concern, a vulnerability, or a privacy question we haven't answered? Responsible disclosure goes to a monitored inbox. We respond inside one business day and credit researchers on request.